The Enzo Biochem lawsuit is one of the largest healthcare data breach class actions in recent years, and millions of patients may be entitled to real compensation in 2026. If you received a letter saying your personal or medical information was exposed, you are not alone.
The breach hit Enzo Biochem and its clinical laboratory operations in spring 2023. Attackers accessed sensitive data belonging to approximately 2.47 million patients. That number puts this breach among the most serious violations of patient privacy in recent U.S. history.
This article covers everything you need to know. What happened, who qualifies, how much the settlement pays, and how to file your claim before the deadline closes.
What Is the Enzo Biochem Lawsuit?
The Enzo Biochem lawsuit is a class action legal case filed against Enzo Biochem Inc. and its subsidiary Enzo Clinical Labs following a ransomware attack that exposed the private health and personal information of roughly 2.47 million patients.
The lawsuits allege that Enzo failed to protect sensitive patient data, including Social Security numbers, diagnoses, lab test results, and dates of birth. Plaintiffs argue this failure violated HIPAA standards and basic data security obligations.
Multiple class action complaints were filed in federal court. The cases were consolidated in the U.S. District Court for the Eastern District of New York.
| Basic Case Facts | Details |
|---|---|
| Defendant | Enzo Biochem Inc. and Enzo Clinical Labs |
| Type of Lawsuit | Class Action / Data Breach |
| Number of Victims | Approximately 2.47 million |
| Court | Eastern District of New York |
| Year Breach Occurred | 2023 |
| Settlement Year | 2026 (projected) |
The core legal claim is straightforward. The company held your personal health data. It did not protect it. Now it may owe you money.
How the Enzo Biochem Data Breach Lawsuit Started
The Enzo Biochem data breach lawsuit started after a ransomware attack struck the company’s systems in late April 2023. Hackers gained access to internal networks and stole a massive trove of patient data.
Enzo discovered the breach around April 6, 2023, and confirmed it publicly weeks later. Once patients began receiving notification letters, the lawsuits started pouring in almost immediately.
Law firms across the country filed complaints within weeks of the public disclosure. Plaintiffs alleged that Enzo had used outdated security systems and failed to implement reasonable safeguards that any major healthcare organization should have in place.
Think of it like leaving a filing cabinet of patient records unlocked in a public hallway. The damage was foreseeable, and the company had the responsibility to prevent it.
Key Filing Fact: Several federal class action complaints were filed in May and June 2023, shortly after breach notifications went out to affected individuals.
What Happened in the Enzo Biochem Case?
The Enzo Biochem case centers on a ransomware attack that breached the company’s computer systems and allowed cybercriminals to access and copy protected health information stored across Enzo’s networks.
Enzo Biochem is a New York-based molecular diagnostics company. It processes lab tests for patients across the New York region and beyond. The company stores enormous amounts of sensitive health data as part of its business.
The attackers exploited security weaknesses and extracted files containing the personal and medical records of over two million patients. Enzo later confirmed that employee login credentials had been shared across multiple accounts, which is a basic security failure.
- Attackers accessed: names, test information, Social Security numbers, dates of birth, diagnoses
- The breach affected: patients who had lab work processed through Enzo Clinical Labs
- The method: ransomware combined with credential theft
- The exposure window: data accessed over at least a two-day period
Enzo notified the U.S. Department of Health and Human Services and began mailing patient notification letters in the weeks following the confirmed breach.
Key Takeaway: The Enzo Biochem breach exposed medical and personal records of 2.47 million patients due to a ransomware attack and poor internal security practices.
How Was Enzo Biochem Patient Data Stolen?
Enzo Biochem patient data was stolen through a ransomware attack that exploited weak credential management inside the company’s IT systems. Investigators found that Enzo employees had been sharing login credentials across multiple accounts, which gave attackers a simple way in.
Once inside, the hackers had access to files containing protected health information. They copied that data before the company even detected the intrusion.
This is a textbook example of what cybersecurity professionals call a “low-sophistication, high-damage” breach. The attackers did not need advanced hacking tools. They just used stolen or shared passwords.
| Data Type Exposed | Confirmed? |
|---|---|
| Full Name | Yes |
| Date of Birth | Yes |
| Social Security Number | Yes |
| Lab Test Type | Yes |
| Medical Diagnosis or Results | Yes |
| Financial Account Data | Not confirmed |
| Driver’s License Number | Not confirmed for all |
The type of data stolen is especially damaging. Medical information and Social Security numbers together are a goldmine for identity thieves. That combination can fuel fraudulent tax filings, medical identity theft, and credit fraud for years.
The Enzo Biochem Clinical Labs Breach Explained
The Enzo Biochem clinical labs breach refers specifically to the attack on Enzo Clinical Labs, a subsidiary of Enzo Biochem that handles diagnostic testing services for patients in the greater New York area and beyond.
Enzo Clinical Labs operates testing facilities and processes results for physicians who order lab work for their patients. When you go to a doctor and they order blood work or diagnostic tests, a company like Enzo handles the processing. That means they hold your records.
The breach hit this subsidiary directly. Patient data stored in the clinical labs division was among the records accessed and copied by attackers.
Many people who received breach notification letters did not even realize they had used Enzo Clinical Labs. Your doctor may have ordered tests processed through Enzo without you ever knowing the company’s name.
- Enzo Clinical Labs is a wholly-owned subsidiary of Enzo Biochem Inc.
- It operates laboratory testing facilities serving New York and surrounding states
- The breach data included clinical test results, not just administrative information
Key Takeaway: You may be affected by the Enzo Clinical Labs breach even if you never directly signed up with or contacted Enzo, because your doctor’s office may have sent your tests there automatically.
Enzo Biochem Lawsuit Eligibility: Do You Qualify?
You qualify for the Enzo Biochem lawsuit if your personal or medical information was exposed in the April 2023 data breach and you were notified by Enzo or can confirm your data was affected.
Eligibility is not limited to people who suffered documented identity theft. Simply having your data exposed in the breach is enough to be a class member in most class action data breach settlements.
The general eligibility criteria look like this:
| Eligibility Requirement | Details |
|---|---|
| Received breach notification letter | Strong indicator of eligibility |
| Had lab work processed through Enzo Clinical Labs | Qualifies as potential class member |
| Resided in affected service area | Primarily New York and surrounding states |
| Time period of breach | Data breach occurred April 2023 |
| Suffered documented harm (for higher tiers) | Required for larger compensation claims |
You do not have to prove that your identity was stolen to participate. The base level of compensation is available to class members who simply confirm their data was part of the breach.
If you have documented out-of-pocket losses tied to the breach, such as costs for credit monitoring, identity theft recovery services, or fraud remediation, you may qualify for a higher payout tier.
Who Qualifies for the Enzo Biochem Settlement?
Anyone whose personal or protected health information was compromised in the Enzo Biochem data breach qualifies as a class member and is potentially eligible for the settlement.
The class definition in consolidated class action settlements like this one typically includes all persons who received a breach notification letter from Enzo Biochem or Enzo Clinical Labs following the April 2023 incident.
- You had lab tests processed by Enzo Clinical Labs
- You received a data breach notification letter from Enzo
- Your name, Social Security number, or health data was part of the stolen files
- You can be identified in Enzo’s records as an affected patient
People who experienced out-of-pocket losses because of the breach may qualify for a higher compensation tier. This includes money spent on credit freezes, fraud alerts, identity protection services, or time spent dealing with identity theft fallout.
Bold Stat: Approximately 2.47 million individuals are believed to fall within the class definition based on the scope of the breach as reported to federal regulators.
Key Takeaway: You likely qualify if Enzo sent you a breach notice or if your lab work was processed through Enzo Clinical Labs around or before April 2023.
Did You Get an Enzo Biochem Data Breach Notice?
If you received an Enzo Biochem data breach notice, that letter is your strongest evidence that your personal information was compromised in the April 2023 ransomware attack.
Enzo Biochem was required under federal HIPAA law and applicable state laws to notify affected individuals after confirming the breach. The company mailed notification letters to patients whose records were accessed.
The notice you received should include:
- A description of what happened and when
- The types of information involved (name, Social Security number, lab data, etc.)
- Steps Enzo is taking in response
- Information about free credit monitoring or identity protection services being offered
- Contact information for a dedicated response line
Do not throw this letter away. It is your primary documentation for filing a settlement claim. If you lost the letter, you may still be able to confirm your status by contacting the claims administrator directly once the settlement process opens.
Not receiving a letter does not automatically mean you were unaffected. Some affected individuals may not have received a letter due to outdated contact information in Enzo’s records.
Enzo Biochem Settlement 2026: What to Expect
The Enzo Biochem settlement in 2026 is expected to be a negotiated class action resolution that compensates affected patients through a structured settlement fund, with payments distributed after court approval and a claims filing period.
As of 2026, the litigation has progressed through consolidation, class certification proceedings, and settlement negotiations. A formal settlement agreement, once approved by the presiding federal judge, triggers a claims period during which class members must submit their claims to receive payment.
| Settlement Phase | Projected Timing |
|---|---|
| Settlement Agreement Finalized | 2025 to early 2026 |
| Court Preliminary Approval | Early 2026 |
| Claims Filing Period Opens | Mid-2026 |
| Objection and Opt-Out Deadline | Mid-2026 |
| Final Approval Hearing | Late 2026 |
| Payment Distribution | Late 2026 or early 2027 |
These timelines are estimates based on how similar data breach class action settlements have moved through the federal court system. Courts can adjust schedules at any time.
The Eastern District of New York has managed numerous high-profile class actions. Cases of this complexity typically take three to four years from breach to payment, which puts 2026 payouts within a realistic window.
How Much Is the Enzo Biochem Settlement Amount?
The Enzo Biochem settlement amount has not been publicly confirmed as a final fixed number as of 2026, but comparable healthcare data breach settlements of this scale have produced total settlement funds ranging from tens of millions to over one hundred million dollars.
Individual payouts typically fall into two or three tiers based on the type of harm you can document.
| Compensation Tier | Who Gets It | Estimated Range |
|---|---|---|
| Base Award (all class members) | Everyone with confirmed data exposure | $50 to $250 |
| Documented Loss Tier | Those with receipts for out-of-pocket costs | Up to $2,500 |
| Extraordinary Harm Tier | Victims of documented identity theft tied to breach | Up to $5,000 or more |
These ranges are based on the structure of comparable data breach settlements such as those involving Anthem, Premera Blue Cross, and Practicefirst Medical Management. They are estimates, not guarantees.
The total fund size directly affects individual payouts. If the fund is large but claims are few, payouts increase. If claims volume is high, the per-person amount may be lower than the tier cap.
Key Takeaway: Your actual payout depends on the total settlement fund size, the number of claims filed, and the level of harm you can document with receipts or records.
Enzo Biochem Lawsuit Payout: What Could You Receive?
Your Enzo Biochem lawsuit payout will depend on which compensation tier you qualify for and how many total claims are filed by class members before the deadline.
At the base level, class members who simply confirm their data was exposed can expect a relatively modest payout. Most healthcare data breach base awards fall between $50 and $250. That number sounds small, but it requires zero documentation of harm.
If you have actual losses tied to the breach, your payout can be significantly larger.
Documented losses that can increase your payout:
- Credit monitoring or identity theft protection costs you paid out of pocket
- Bank or credit card fraud investigation fees
- Costs for placing credit freezes or fraud alerts
- Lost wages if you spent time dealing with identity theft issues
- Professional fees paid to deal with fraudulent accounts
- Unreimbursed losses from fraud tied directly to the breach
The key word is “documented.” You will need receipts, bank statements, or other records showing actual costs. The claims administrator will review your documentation before approving elevated payouts.
Is the Enzo Biochem Settlement Legit?
Yes, the Enzo Biochem settlement is a legitimate legal proceeding in a federal court, not a scam. The case is real, the breach is confirmed, and the litigation is actively moving through the U.S. District Court for the Eastern District of New York.
Here is how you can verify it is real:
- The breach was reported to the HHS Office for Civil Rights and is publicly listed in their data breach portal
- Multiple reputable law firms filed the original class action complaints
- Federal court records confirm the cases were consolidated and are proceeding
- Enzo Biochem publicly acknowledged the breach and notified regulators
Be careful, though. Scammers sometimes create fake settlement websites after high-profile class action announcements. A few red flags to watch for:
| Red Flag | What It Means |
|---|---|
| Website asks for payment to file a claim | Scam. Real settlements never charge you to file. |
| Requests your full bank account number upfront | Scam. Payments come to you after approval. |
| No court case number or administrator name listed | Likely fake or unofficial |
| Promises an exact large payout before court approval | Not realistic for any legitimate settlement |
The legitimate settlement process will be court-supervised. All official claim forms will come through the officially appointed claims administrator, not through unsolicited emails or cold-call phone solicitations.
Understanding the Enzo Biochem Data Breach Settlement
The Enzo Biochem data breach settlement is the formal legal resolution negotiated between the plaintiff class (affected patients) and Enzo Biochem Inc. to compensate victims and require the company to improve its data security practices.
Class action settlements like this one serve two purposes. First, they put money into the hands of the people who were harmed. Second, they force the defendant company to make changes that prevent the same thing from happening again.
The settlement agreement in cases like this typically includes:
- A cash fund used to pay claimants
- Injunctive relief requiring Enzo to implement stronger cybersecurity measures
- Attorney fees and litigation costs paid separately from the class fund
- A claims administrator responsible for reviewing and processing claims
Key Takeaway: The Enzo Biochem data breach settlement is not just about money. It also forces the company to change how it protects your data going forward.
The settlement does not mean Enzo admitted fault. Companies can settle class actions without admitting any wrongdoing, which is standard practice in the U.S. legal system.
Enzo Biochem Class Action: How It Works
The Enzo Biochem class action is a legal mechanism that lets millions of affected patients sue a company together as one unified group, rather than each person filing an individual lawsuit.
Class action lawsuits exist because individual harm in a data breach case is often not large enough to justify a solo lawsuit. Your personal loss might be $150 in fraud costs. But when 2.47 million people each suffer similar harm, the combined damage is massive.
Here is the basic structure of how the class action process works in this case:
- Breach occurs and affected patients are notified
- Plaintiffs (class representatives) file initial complaints
- Law firms seek to consolidate cases before one judge
- Attorneys file for class certification to represent all affected individuals
- Parties negotiate a settlement (or go to trial)
- Judge grants preliminary approval of settlement
- Class members are notified and given time to file claims, object, or opt out
- Final approval hearing occurs
- Payments are distributed
You do not need to hire a lawyer to participate. Your interest is already represented by the class action attorneys who negotiated the settlement. They get paid from the settlement fund, not from your payout.
How to File an Enzo Biochem Claim
To file an Enzo Biochem claim, you need to submit a claim form through the official settlement claims administration process before the stated filing deadline.
Here is a step-by-step breakdown:
| Step | What to Do |
|---|---|
| Step 1 | Locate your breach notification letter from Enzo |
| Step 2 | Go to the official settlement website (announced after court approval) |
| Step 3 | Complete the claim form with your personal information |
| Step 4 | Select your compensation tier (base or documented loss) |
| Step 5 | Upload supporting documentation if claiming a higher tier |
| Step 6 | Submit the form before the deadline |
| Step 7 | Save your confirmation number |
Do not miss the deadline. Courts are strict about claims filing periods. If you file late, you lose your right to compensation even if you clearly qualify.
You have the right to opt out of the settlement if you prefer to pursue an individual lawsuit. You also have the right to object to the settlement terms before the final approval hearing. Both options carry strict deadlines.
If you cannot locate your breach notice, look for any mail or email from Enzo Biochem, Enzo Clinical Labs, or a company called “SettlementAdministrator” or similar identifying names during the notification period following mid-2023.
Enzo Biochem Lawsuit Timeline: Key Dates
The Enzo Biochem lawsuit timeline spans from the initial breach in spring 2023 through expected settlement payments in late 2026 or early 2027.
| Date / Period | Event |
|---|---|
| April 6, 2023 | Enzo discovers ransomware attack on its systems |
| April 6-7, 2023 | Data accessed and copied by attackers |
| Late April / May 2023 | Enzo publicly discloses the breach |
| May to June 2023 | Multiple class action lawsuits filed in federal court |
| 2023 to 2024 | Cases consolidated in Eastern District of New York |
| 2024 | Class certification and discovery proceedings |
| Late 2024 to 2025 | Settlement negotiations between parties |
| Early to mid 2026 | Preliminary court approval of settlement |
| Mid 2026 | Claims filing period opens for class members |
| Mid to late 2026 | Deadline to file claims, opt out, or object |
| Late 2026 | Final approval hearing |
| Late 2026 / Early 2027 | Settlement payments distributed to claimants |
These dates reflect the realistic trajectory of a complex data breach class action in the Eastern District of New York. Individual court orders may shift these windows.
Key Takeaway: The full Enzo Biochem lawsuit timeline runs from April 2023 through an expected 2026 payout, meaning affected patients will have waited three or more years from breach to compensation by the time checks go out.
Enzo Biochem Lawsuit Status in 2026
As of 2026, the Enzo Biochem lawsuit is in its settlement resolution phase, with proceedings focused on finalizing the settlement agreement, securing court approvals, and opening the claims filing window for affected patients.
The litigation moved through initial filings, consolidation, and discovery between 2023 and 2024. Mediation and settlement talks between plaintiff attorneys and Enzo’s legal team were the primary focus through 2025. By 2026, the case is positioned for resolution rather than trial.
What this means practically for you:
- A settlement fund is expected to be approved and funded
- The claims filing period is expected to open in 2026
- Payments are the goal for late 2026 or early 2027
- No action is needed from you yet if the claims period has not officially opened
Stay alert for official mail or email from the claims administrator. Official notices will come from a court-appointed settlement administrator, not from law firms soliciting your information.
The New York Attorney General’s office separately investigated Enzo Biochem’s data security practices following the breach. That investigation adds additional regulatory pressure on the company and strengthens the plaintiff class’s overall legal position.
Bold Fact: Enzo Biochem disclosed the breach to the HHS Office for Civil Rights, listing approximately 2,470,000 individuals as affected, making it one of the largest healthcare data breaches of 2023.
Frequently Asked Questions
How much money will I get from the Enzo Biochem lawsuit?
Most base-tier claimants can expect between $50 and $250 from the Enzo Biochem settlement.
If you have documented out-of-pocket losses tied to the breach, you may recover up to $2,500 or more depending on settlement terms.
The exact amount depends on total claims filed and the size of the settlement fund approved by the court.
Who qualifies for the Enzo Biochem data breach settlement?
Anyone whose personal or medical information was exposed in the April 2023 Enzo Biochem ransomware attack qualifies as a class member.
This typically includes anyone who received a breach notification letter from Enzo or whose lab work was processed through Enzo Clinical Labs.
You do not need to prove identity theft occurred. Data exposure alone is generally sufficient for base-tier eligibility.
What is the deadline to file an Enzo Biochem claim?
The official claims filing deadline will be set by the court upon preliminary approval of the settlement agreement.
Based on the 2026 settlement timeline, the filing deadline is expected to fall in mid to late 2026.
Watch for official mail or email from the settlement claims administrator, as that notice will contain your specific deadline.
Was my Social Security number exposed in the Enzo Biochem breach?
Enzo Biochem confirmed that Social Security numbers were among the data types accessed in the April 2023 breach.
Not every affected individual had a Social Security number exposed, but for many patients it was part of the compromised records.
Your breach notification letter should specify which types of your data were involved.
Is the Enzo Biochem settlement real or a scam?
The Enzo Biochem settlement is a real, court-supervised legal proceeding in federal court. The breach is confirmed and publicly reported to federal health regulators.
Be aware that scammers sometimes launch fake settlement sites after high-profile data breach cases.
The legitimate settlement process will never ask you to pay a fee to file a claim, and official notices will come from a court-appointed administrator.
Where Things Stand Right Now
The Enzo Biochem lawsuit is real, serious, and moving toward a resolution that could put money in your pocket. If your data was exposed in the 2023 breach, 2026 is the year to act.
Watch for official mail from the settlement administrator. Keep your breach notification letter somewhere safe.
When the claims period opens, file promptly. Missing the deadline means walking away from compensation you are legally entitled to. The process is straightforward. The window will not stay open forever.
